Extracted

• • Target
    2026-08-14_c7951e14e07de0ad3a455a6cfad97211_elex_wannacry
  • Size 8.1MB
  • SHA256 211a0aa3cbc77439136e0255946baf55e9bce1bee9dfa34884673ba0330f11f3
  • MD5 c7951e14e07de0ad3a455a6cfad97211
  • SHA1 27ab91d719d38fdbdf9fa5c75672851a4c503225
  • SHA512 bfc058a4dc89439886a95e18eeb5bab0a7df389460860fbbcfa663ed925418e63e95c4ab274e4eb3de67a5cc307033a66d68e3a1b478e74cd447e5690c381f7e
  • SSDEEP 196608:+pBfrLmqCqxHah5cIEQARNLtzhpYXT8pRuENoQsbF5z:+pZBCSah5xG3hwQ3Td27
  • TLSH
    T17586332237E498B6CA75C4729D1DB3260EB6D78C52404E439489AC516CF3B71AA0F5FF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryhijackloaderloader

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2